The hardest question Sarah was ever asked by a prospect had nothing to do with payroll. It came near
the end of a long call, from a finance director who had been quiet throughout: *"What happens to our
data if we decide you were the wrong choice?"*
It is the question every small vendor gets and almost none can answer, because the honest answer is
usually "we have never thought about it". A company that cannot say what happens on the way out is
asking to be trusted with twelve years of salary history on nothing but goodwill.
This is that answer, and it runs in both directions: what a departing customer gets, and what the
system does with what is left behind.
A company decides to leave. Someone cancels the subscription, or an administrator winds the company
up. Either way it is a deliberate act, and it starts a ninety-day clock.
Nothing changes on day one. The data stays exactly where it is, and at any point in those ninety
days an owner or company admin can download the whole thing from the company profile — one
compressed file with every employee, every attendance day, every payroll run, every policy, in
line-delimited JSON that opens in a spreadsheet or loads into a database without needing Zetta at
all. It is stamped with the database version it came from, so it still makes sense a year later.
At sixty days, thirty days and seven days before the deadline, an email arrives. Each one names the
date, and each one says the data can still be downloaded. Nobody is deleted by surprise.
On the ninetieth day the company's records are archived and then permanently removed — every table
that belongs to it, in one transaction. What is not removed is people: a sign-in belongs to a
person, not to a company, so anyone who also works at another company on Zetta keeps working
without noticing anything at all.
What survives is a single line in the audit trail saying that a company existed and was destroyed,
with the counts and the archive location. Not what was in it. Just that it was.
Everything, until the deadline. A departing company is not degraded, throttled or read-only during
the window — it is exactly the product it was, because the clock is about deletion, not punishment.
Changing your mind is free and needs no support ticket. Reactivate the company, or revive the
subscription, and the clock stops; the deletion is not rescheduled, it simply ceases to exist.
A card expires and nobody notices. This is the one people fear, and it is explicitly not a
departure. A failed payment locks the account until it is fixed — an expired card, an invoice sent
to somebody who has left the company, a bank blocking a foreign charge. None of them schedules
anything for deletion. Locking someone out can be undone in a minute; deleting their payroll
history cannot, so the two never share a trigger.
The reminder emails bounce. The deletion still happens, but the attempt is recorded. A company
with no reachable contact is a fact worth having in the audit trail rather than a silent skip.
The system is down for a month. The customer gets the most urgent warning still owed, not a pile
of three. A "sixty days left" notice arriving after a "seven days left" notice would read as the
deadline moving.
A company that left long ago. Retention did not exist for the whole life of the product, so on
the day it started running there were already companies far past ninety days. None of them was
deleted that night. Nothing is ever destroyed that has not been warned first — the deadline is the
later of the ninety-day window and a week after the final notice actually went out.
Test companies. Ones created for testing or debugging are tagged as such and removed by hand,
not by the clock. They have no customer to warn, so they are excluded from the reminders entirely.
A company that was merged into another. Its records are part of the surviving company's history
now, so the tooling refuses to delete either side of a merge and asks for a human.
Money that lives outside the database. If anything still exists at the payment provider, the
deletion refuses until it is closed there. Zetta will not reach into your payment account on the way
out of the door.